128 lines
4.2 KiB
Bash
128 lines
4.2 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# ========== 配置区 ==========
|
|
# 认证方式二选一(方式一优先):
|
|
# 方式一(推荐): My Profile -> API Tokens 创建的受限 Token, 权限 Zone->DNS->Edit
|
|
API_TOKEN=""
|
|
# 方式二: Global API Key (My Profile -> API Tokens -> API Keys 页面), 配合账号邮箱
|
|
API_EMAIL=""
|
|
API_KEY=""
|
|
# 每条记录一行, 格式: 域名:类型(:proxied)
|
|
# 域名 根域 / 子域 / 泛解析均可, 所属 Zone 自动识别(同一账号下一个 Token 即可)
|
|
# 类型 A=IPv4, AAAA=IPv6
|
|
# proxied 可选: true=开Cloudflare CDN代理, false=纯解析(默认)
|
|
# 以后新增域名只需在下面加一行
|
|
RECORDS=(
|
|
"lmve.net:A"
|
|
"lmve.net:AAAA"
|
|
"*.lmve.net:A"
|
|
"*.lmve.net:AAAA"
|
|
"wnfed.com:A"
|
|
"wnfed.com:AAAA"
|
|
"*.wnfed.com:A"
|
|
"*.wnfed.com:AAAA"
|
|
)
|
|
# ===========================
|
|
|
|
API="https://api.cloudflare.com/client/v4"
|
|
LOG() { echo "[$(date '+%F %T')] $*"; }
|
|
|
|
# 认证头: 优先用受限 Token, 否则用 Global API Key + 邮箱
|
|
AUTH=()
|
|
if [ -n "$API_TOKEN" ]; then
|
|
AUTH=(-H "Authorization: Bearer $API_TOKEN")
|
|
elif [ -n "$API_EMAIL" ] && [ -n "$API_KEY" ]; then
|
|
AUTH=(-H "X-Auth-Email: $API_EMAIL" -H "X-Auth-Key: $API_KEY")
|
|
else
|
|
LOG "!!! 未配置认证信息 (API_TOKEN 或 API_EMAIL+API_KEY)"
|
|
exit 1
|
|
fi
|
|
|
|
# IP 只抓取一次, 多条记录复用
|
|
CACHE4="" CACHE6=""
|
|
declare -A ZONE_CACHE
|
|
|
|
get_ipv4() {
|
|
if [ -z "$CACHE4" ]; then
|
|
CACHE4=$(curl -fsS --max-time 10 -4 https://api.ipify.org 2>/dev/null) || true
|
|
fi
|
|
echo "$CACHE4"
|
|
}
|
|
|
|
get_ipv6() {
|
|
if [ -z "$CACHE6" ]; then
|
|
# 优先取本机网卡上的公网 IPv6 (2000::/3), 排除 ULA 内网地址 (fc00::/7); 取不到再走外部检测
|
|
CACHE6=$(ip -6 addr show scope global 2>/dev/null | awk '/inet6/{print $2}' | grep -E '^[23][0-9a-fA-F]{3}:' | head -1 | cut -d/ -f1) || true
|
|
if [ -z "$CACHE6" ]; then
|
|
CACHE6=$(curl -fsS --max-time 10 -6 https://api64.ipify.org 2>/dev/null) || true
|
|
fi
|
|
fi
|
|
echo "$CACHE6"
|
|
}
|
|
|
|
# 从记录名推断所属 Zone (逐级剥离左边标签, 匹配最长后缀), 结果缓存
|
|
get_zone_id() {
|
|
local rec="$1" cand="$1" resp zid
|
|
while [ "$(echo "$cand" | tr -cd '.' | wc -c)" -ge 1 ]; do
|
|
if [ -n "${ZONE_CACHE[$cand]:-}" ]; then
|
|
echo "${ZONE_CACHE[$cand]}"
|
|
return 0
|
|
fi
|
|
# 含通配符的候选名不可能是 Zone, 直接跳过
|
|
if [[ "$cand" != *"*"* ]]; then
|
|
resp=$(curl -fsS -g --max-time 15 "${AUTH[@]}" \
|
|
"$API/zones?name=$cand&status=active" 2>/dev/null) || true
|
|
zid=$(echo "$resp" | grep -o '"id":"[0-9a-f]\{32\}"' | head -1 | sed 's/.*:"//;s/"$//')
|
|
if [ -n "$zid" ]; then
|
|
ZONE_CACHE[$cand]="$zid"
|
|
echo "$zid"
|
|
return 0
|
|
fi
|
|
fi
|
|
cand="${cand#*.}"
|
|
done
|
|
LOG "!!! 找不到 $rec 所属的 Zone"
|
|
return 1
|
|
}
|
|
|
|
update_record() {
|
|
local name="$1" type="$2" proxied="${3:-false}" zone_id ip=""
|
|
type=$(echo "$type" | tr '[:lower:]' '[:upper:]')
|
|
zone_id=$(get_zone_id "$name") || return 1
|
|
if [ "$type" = "A" ]; then ip=$(get_ipv4); else ip=$(get_ipv6); fi
|
|
[ -z "$ip" ] && { LOG "跳过 $name：获取不到 $type 地址"; return 1; }
|
|
|
|
local resp rec_id="" cur_ip=""
|
|
resp=$(curl -fsS -g --max-time 15 "${AUTH[@]}" \
|
|
"$API/zones/$zone_id/dns_records?type=$type&name=$name" 2>/dev/null) || true
|
|
rec_id=$(echo "$resp" | grep -o '"id":"[0-9a-f]\{32\}"' | head -1 | sed 's/.*:"//;s/"$//')
|
|
cur_ip=$(echo "$resp" | grep -o '"content":"[^"]*"' | head -1 | sed 's/.*:"//;s/"$//')
|
|
|
|
if [ -n "$rec_id" ] && [ "$cur_ip" = "$ip" ]; then
|
|
LOG "$type $name 未变化 ($ip)，跳过"
|
|
return 0
|
|
fi
|
|
|
|
local method="POST" url="$API/zones/$zone_id/dns_records"
|
|
[ -n "$rec_id" ] && { method="PUT"; url="$url/$rec_id"; }
|
|
|
|
local body="{\"type\":\"$type\",\"name\":\"$name\",\"content\":\"$ip\",\"ttl\":120,\"proxied\":$proxied}"
|
|
if curl -fsS -g --max-time 15 -X "$method" "${AUTH[@]}" \
|
|
-H "Content-Type: application/json" -d "$body" "$url" 2>/dev/null \
|
|
| grep -q '"success":true'; then
|
|
LOG "$type $name -> $ip 更新成功"
|
|
else
|
|
LOG "!!! $type $name 更新失败"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
main() {
|
|
for entry in "${RECORDS[@]}"; do
|
|
IFS=':' read -r name type proxied <<< "$entry"
|
|
update_record "$name" "${type:-A}" "${proxied:-false}" || true
|
|
done
|
|
}
|
|
main
|